3 ms·
That's not a bad point. GitHub is convenient, yes, but if you manage security for companies that are collectively worth billions, you want to minimize your atta
by papito 4y ago
That's not a bad point. GitHub is convenient, yes, but if you manage security for companies that are collectively worth billions, you want to minimize your attack surface.
In my experience, security is usually an afterthought in most tech companies. Just look at how many MongoDB instances in production were running on open ports with the default password, which was... no password.
- throwawaysleep 4y agoAt my jobs, employees routinely share passwords in Slack or use simple passwords. Frankly, as an employee, security is not my problem.
- lukev 4y agoSolving security issues and maintaining secure systems isn't your problem, but adhering to company policy most certainly is, and the policy almost certainly forbids you from sharing passwords (especially via Slack.) Unless you're in a tiny or ass-backward company that doesn't even have a policy that covers such things.
- throwawaysleep 4y agoThey have a policy, but there is nobody who cares to enforce it.
- yakubin 4y agoIt always amazes me how many companies host their source code in “the cloud” visible to external companies, accessible from the public internet, only a single bug/security vulnerability/human error away from being leaked. The companies I’ve worked for so far host their source code on their own servers, which are physically under their control, and aren’t accessible from the public internet. Add on top of it that functionally GitHub/GitLab don’t hold a candle to code review functionality of Gerrit, project management of Redmine/Jira; and the only explanation is that those companies really, really don’t want to hire 1/2 sysadmins to manage their infrastructure.
- ralph84 4y agoCompanies host data a lot more valuable than source code in the cloud. Developers like to think we’re the center of the business, but access to a company’s Salesforce or NetSuite instance is a lot more economically valuable than access to a company’s GitHub org.
- yakubin 4y agoThose things are no less incredible to me than GitHub. (Also not used at the companies I’ve worked for so far.)
- m1ghtym0 4y agoAn alternative to using own servers, which are not feasible for every company would be isolated and encrypted GitLab/GitHub deployments as described here: https://dev.to/flxflx/setting-up-a-confidential-gitlab-333h https://dev.to/flxflx/setting-up-a-confidential-gitlab-333h
- trallnag 4y agoCompanies with hundreds of sysadmins and billions of revenue or moving to the cloud... It has nothing to do with the cost of a handful of additional engineers.